Updating#
Update with APT#
Updating LiveShield is extremely simple, because we use APT.
Please run following commands as a root (or using sudo):
apt update
apt upgrade
This will update all system and LiveShield packages to the latest version. Follow instructions on screen if any additional steps are required.
Version checking#
Starting with Manager 1.2.0, the web interface shows running component versions and warns when packages are outdated or incompatible. There is no separate settings page for this. Versions and update status are checked automatically while you use Manager.
Component versions#
Running versions appear in the page footer on every screen:
M:1.2.0 | A:1.2.0 | W:1.1.0
M - Manager package version
A - connected Analyser version (shown only when Analyser is connected and version is known)
W - lowest version among online Workers (shown only when at least one Worker is online)
The sidebar footer shows Analyser TCP connection state separately: Connected or Not Connected. This indicator reflects the socket connection, not whether the Analyser version is compatible.
Version strings are checked and refreshed on page refresh and connection status is refreshed automatically in the background.
Update recommended#
When a running component is behind the latest package available from apt.liveshield.net, the sidebar shows a red Update recommended banner. Hover over it to see which components are outdated and the available version (for example, Manager: 1.1.4 → 1.2.0).
Manager checks its own version always. Analyser is checked only when connected. Each online Worker is checked individually. The comparison uses APT repository data, refreshed about once per hour.
This is informational only. LiveShield keeps working normally. To update, run apt update and apt upgrade as described above.
Minimum Analyser version#
Manager 1.2.0 introduced a minimum Analyser version requirement.
Manager and Analyser exchange statistics and configuration over a TCP protocol. The minimum version marks the oldest Analyser release that speaks a compatible protocol. Analysers below this version are treated as incompatible even if the TCP connection succeeds.
Note
An Analyser can show Connected in the sidebar while still being incompatible. Connection status and version compatibility are separate checks.
When the connected Analyser is below the minimum:
Worker statistics stop updating in Manager (Workers appear offline)
Configuration changes are not propagated to Analyser
Apply Configuration in the sidebar is blocked with the message:
Analyser version is too old, please update to vX.X.X or newer
The footer A: version turns red. The sidebar shows Update required instead of Update recommended, with a tooltip like Analyser: X.X.X (minimum: X.X.X).
Upgrade the Analyser package with APT and restart the Analyser service if needed. After reconnect, statistics and configuration propagation resume.
Manager version rejection#
Starting with Analyser 1.2.0, it can reject an outdated Manager after the connection handshake. This is the reverse of the minimum Analyser check, the Analyser decides that the Manager version is too old.
When rejected, the operational impact is the same: no statistics, no configuration propagation, and licence updates are skipped until Manager is upgraded and reconnects.
The footer M: version turns red. The sidebar shows Update required with a tooltip like Manager: X.X.X (rejected by analyser). Apply Configuration returns: Manager version is rejected by Analyser, please update to the newest version.
Upgrade the Manager package with APT. The rejection clears on reconnect after the upgrade.
Update required vs Update recommended#
The sidebar update banner uses two labels:
Update required - Analyser is below the minimum version, or Analyser rejected the Manager version. LiveShield suspends statistics and configuration propagation until the incompatible component is upgraded.
Update recommended - one or more components are behind the latest APT package, but all versions are mutually compatible. Operation is not blocked.
When both conditions apply to the same component, the tooltip shows the incompatibility message rather than the APT running → available line. If everything is current and compatible, the banner is hidden.
Changelog#
Worker#
1.2.1 (11 July 2026)
FIXED VLAN ID incorrectly retrieved when PCP or DEI bit set.
1.2.0 (10 July 2026)
ADDED TCP flags as a protocol (TCPACK, TCPSYNACK, TCPFIN, TCPRST, TCPPSH, TCPURG).
ADDED Minimum worker and analyser version validation.
ADDED “INVALID PROTOCOL” now matches any unknown protocol.
CHANGED Internal startup and app logic in order to allow new operating modes in the future.
CHANGED Various performance and security tweaks related to memory operations.
CHANGED Internal analyser<>worker communication structure and message types.
FIXED Rare startup failures due to lcore startup synchronisation issues.
1.1.5 (18 June 2026)
FIXED Possible data corruption on analyser connections.
1.1.4 (5 May 2026)
CHANGED Performance improvements
1.1.3 (27 March 2026)
FIXED Very rare situation where internal ACL programming could fail, due to invalid memory initialization.
1.1.2 (22 March 2026)
FIXED Improper traffic counters during process startup under heavy load.
1.1.1 (22 March 2026)
FIXED Some worker-actions were not properly programmed into the classification engine
1.1.0 (19 March 2026)
ADDED Single worker-action can now create multiple internal ACL classification rules.
CHANGED Changed protocol pattern detection to make detection more accurate.
CHANGED DPDK version updated to 25.11.0.
1.0.2 (05 February 2026)
FIXED Worker-actions now properly loaded during restart in heavy loaded environments.
ADDED Packets with IPv4 Options are now properly distinguished and marked as INVALID proto.
1.0.1 (29 December 2025)
FIXED Package installation scripts.
Analyser#
1.2.1 (11 July 2026)
FIXED Disabled advanced profile rules can cause inability to start the analyser process.
1.2.0 (10 July 2026)
ADDED TCP flags as a protocol (TCPACK, TCPSYNACK, TCPFIN, TCPRST, TCPPSH, TCPURG).
ADDED Minimum worker, analyser and manager version validation.
ADDED “INVALID PROTOCOL” now generates a rule blocking all unknown protocols.
CHANGED Internal analyser<>worker communication structure and message types.
CHANGED Advanced filtering now checks for data consistency in the database, preventing the app from starting with invalid data.
CHANGED FlowSpec rules for packet fragments are now fully handled (first packet, last packet, DF, etc.) and better displayed.
FIXED Advanced filtering now works correctly for sport/dport = 0 and length = 0.
FIXED Crashes on too long worker name. Fixed various memory-related operations.
FIXED Summary statistics in multi-worker environments are now properly calculated.
FIXED Very rare situation where the license may fail to load.
FIXED Incorrect FlowSpec rule generation when prefiltering was enabled on “IP” protocol.
FIXED Timeout was not checked when no workers were connected.
1.1.5 (18 June 2026)
FIXED Possible data corruption on worker connections.
FIXED Undefined behaviour in multi-worker environments.
FIXED Invalid values printed in blackholing logs.
CHANGED OSI layers parser is now limited to specific layers to achieve better performance.
CHANGED pcpp parser logs are now suppressed due to the possibility of invalid L7 data.
CHANGED TCP streams to workers and manager are now fully multithreaded.
1.1.4 (5 May 2026)
FIXED Next-hop for IPv6 blackholing
FIXED Upstreams sometimes not correctly loaded from database
CHANGED Statistics collection for better attack visibility
CHANGED Internal detection logic (edited)
1.1.3 (10 April 2026)
FIXED Rare issue with more-specific prefix ordering, causing less-specific rules to be processed.
FIXED IPv6 parsing in bgp session peer address.
FIXED BGP Blackholing routes flapping when timeout set to 0.
1.1.2 (27 March 2026)
CHANGED GoBGP version updated to 4.3.0 along with the API adjustments.
CHANGED Improvements to the detection and mitigation time.
CHANGED Improved fragment handling.
FIXED Selective blackholing routes being incorrectly re-announced and stalled.
1.1.1 (22 March 2026)
FIXED Subnet aggregation triggered incorrectly when disabled
FIXED Subnet aggregation sometimes not timing out properly
FIXED Attack volume not properly calculated when automatically aggregated
1.1.0 (19 March 2026)
ADDED Support for per-subnet detection and mitigation (carpet bomb attacks).
ADDED Automatic subnet aggregation.
CHANGED All blackholing routes now contain configurable global community.
CHANGED Prefiltering rules are now more accurate. Typical ports now contain src/dst pair.
1.0.6 (20 February 2026)
FIXED DRM and Telemetry counters were not properly calculated in some cases.
FIXED GoBGP calls will now timeout instead of hanging indefinitely if GoBGP is not responding.
1.0.5 (05 February 2026)
CHANGED DRM and Telemetry has been reworked to use new library and properly reflect documentation.
CHANGED Analyser now includes proper user-agent in outgoing webhook requests.
ADDED License info is now reported to the Manager module.
ADDED Connection with InfluxDB is now being validated during startup.
ADDED Support for prefix templates.
1.0.4 (27 January 2026)
FIXED Parsing new lines in SendEmailNotification action.
FIXED Crash due to PostgreSQL connection race condition in Event Pipelines.
FIXED Improper string handling in Event Pipelines actions.
1.0.3 (23 January 2026)
REMOVED Filter Rules generation toggle was removed.
1.0.2 (13 January 2026)
FIXED Regular BGP blackholing not applied when no Upstreams are configured.
1.0.1 (29 December 2025)
FIXED Package installation scripts.
Manager#
1.2.1 (29 July 2026)
FIXED Unable to allow User to Access more than ~10 prefixes
FIXED Crash when User with allowed prefixes scope enters Attacks List
FIXED Missing Access Control when generating Attacks CSV
FIXED Exporting more than 20 selected Attacks to CSV from Attacks List
1.2.0 (10 July 2026)
ADDED KSC report export to CSV and PDF for selected attacks
ADDED Manager version rejection by Analyser - incompatible Manager versions suspend statistics and configuration propagation until upgrade and reconnect
ADDED “Update required” indicator and red Manager version in footer when rejected by Analyser
ADDED Component version display in sidebar and footer (Manager / Analyser / Worker), including connected Analyser version
ADDED Sidebar “Update recommended” indicator when Manager, Analyser, or Workers are behind available APT versions
ADDED Analyser minimum version enforcement (1.2.0) - incompatible Analysers are ignored for data exchange
ADDED “Update required” indicator and red Analyser version in footer when below minimum
ADDED Additional attack protocol labels (TCPACK, TCPSYNACK, TCPFIN, TCPRST, TCPPSH, TCPURG)
CHANGED Invalid protocol display name from “INVALID” to “INVALID PROTOCOL”
FIXED Analyser TCP socket CPU hang when clients send invalid protocol data
FIXED Analyser TCP socket communication after protocol update
FIXED Workers incorrectly shown as online after Analyser disconnects
FIXED Dashboard active IPv4/IPv6 summary counts
FIXED Charts showing dates in incorrect timezone
1.1.4 (9 June 2026)
FIXED 405 Method Not Allowed response on some actions
1.1.3 (4 June 2026)
FIXED rate-limiting causing false-positive 429 http errors
1.1.2 (4 June 2026)
FIXED potential high CPU usage
1.1.1 (5 May 2026)
ADDED Attack traffic charts in attack details. Separate for whole attack and upstreams.
CHANGED Redesigned dashboard page
1.1.0 (19 March 2026)
ADDED Option to set thresholds for subnets in Filtering Rules, Filtering Rule Templates and Blackholing profiles
CHANGED Allowed for creating Blackholing Profiles thresholds when creating Blackholing Profile
FIXED Advanced Filtering Rules sorting issue
FIXED Filtering Rule Event Pipeline reset when using template
FIXED Performance issues of main page charts
1.0.6 (20 February 2026)
FIXED Occasional application crash on filtering rule threshold values inputs
1.0.5 (20 February 2026)
ADDED Support for mobile devices
1.0.4 (05 February 2026)
ADDED Filtering Rule templates
ADDED Better license handling
CHANGED Moved BGP Configuration to Devices page close to BGP Routers
CHANGED Moved Notification Templates to Filtering Page close to Event Pipelines
FIXED Notification Template not applying to Event Pipeline action when adding new action
FIXED Other various UI bugs
1.0.3 (27 January 2026)
FIXED Database max pps/Bps field types.
1.0.2 (23 January 2026)
CHANGED Advanced Filtering Profiles were moved to Filtering tab
CHANGED BGP Routers can be now created with multiple sessions
REMOVED Filter Rules generation toggle in Analyser Configuration was removed as this is default and only possible behaviour now
1.0.1 (29 December 2025)
FIXED Package installation scripts.
Helper#
1.0.2 (27 January 2026)
FIXED Handling exceptions status codes. Auto-restart on exception should now work properly.
1.0.1 (29 December 2025)
FIXED Package installation scripts.
Documentation#
1.1.2 (29 July 2026)
CHANGED Changelog updated.
1.1.1 (11 July 2026)
CHANGED Documentation cache is now reduced.
CHANGED Changelog updated.
1.1.0 (10 July 2026)
ADDED Documentation regarding the reporting tool.
ADDED Description of the new protocols.
CHANGED Changelog updated.
1.0.13 (18 June 2026)
CHANGED Changelog updated.
1.0.12 (9 June 2026)
CHANGED Changelog updated.
1.0.11 (4 June 2026)
CHANGED Changelog updated.
1.0.10 (4 June 2026)
CHANGED Changelog updated.
1.0.9 (5 May 2026)
CHANGED Screenshots updated to reflect new UI changes.
CHANGED Changelog updated.
1.0.8 (10 April 2026)
CHANGED Changelog updated.
1.0.7 (27 March 2026)
CHANGED Changelog updated.
1.0.6 (22 March 2026)
CHANGED Changelog updated.
1.0.5 (22 March 2026)
CHANGED Changelog updated.
1.0.4 (19 March 2026)
ADDED Subnet aggregation subsection in the “Detection and filtering” section.
ADDED Subnet detection explanation.
CHANGED Screenshots and descriptions updated to reflect new UI changes.
CHANGED BGP example configurations updated to allow subnet blackholing.
CHANGED Changelog updated.
1.0.3 (20 February 2026)
ADDED FAQ section.
CHANGED Changelog updated.
1.0.2 (05 February 2026)
CHANGED Changelog updated.
CHANGED Screenshots and descriptions updated to reflect new UI changes.
ADDED Added “Templates” section in the “Detection and filtering”.
1.0.1 (27 January 2026)
CHANGED Changelog updated.
1.0.0 (25 January 2026)
Initial public documentation release.